From bffa3e9116abb7038b432443f16b1bd390e80245 Mon Sep 17 00:00:00 2001 From: Marco Eichelberg Date: Thu, 23 Jan 2025 15:51:21 +0100 Subject: [PATCH] Fixed issue with invalid RLE compressed DICOM images. Fixed issue when processing an RLE compressed image where the RLE header contains an invalid stripe size. Thanks to Ding zhengzheng for the report and the sample file (PoC). --- dcmdata/libsrc/dcrleccd.cc | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/dcmdata/libsrc/dcrleccd.cc b/dcmdata/libsrc/dcrleccd.cc index 732e6254c..68f45443b 100644 --- a/dcmdata/libsrc/dcrleccd.cc +++ b/dcmdata/libsrc/dcrleccd.cc @@ -1,6 +1,6 @@ /* * - * Copyright (C) 2002-2024, OFFIS e.V. + * Copyright (C) 2002-2025, OFFIS e.V. * All rights reserved. See COPYRIGHT file for details. * * This software and supporting documentation were developed by @@ -362,6 +362,12 @@ OFCondition DcmRLECodecDecoder::decode( } /* while */ // last fragment for this RLE stripe + if (inputBytes + byteOffset > fragmentLength) + { + DCMDATA_ERROR("stream size in RLE header is wrong"); + inputBytes = fragmentLength-byteOffset; + } + result = rledecoder.decompress(rleData + byteOffset, OFstatic_cast(size_t, inputBytes)); // special handling for zero pad byte at the end of the RLE stream